Bypassing Device Guard with .NET Assembly Compilation Methods

WildByDesign · Jul 10, 2017

Bypassing Device Guard with .NET Assembly Compilation Methods
By Matt Graeber

Link: http://www.exploit-monday.com/2017/07/bypassing-device-guard-with-dotnet-methods.html

Tl;dr

This post will describe a Device Guard user mode code integrity (UMCI) bypass (or any other application whitelisting solution for that matter) that takes advantage of the fact the code integrity checks are not performed on any code that compiles C# dynamically with csc.exe. This issue was reported to Microsoft on November 14, 2016. Despite all other Device Guard bypasses being serviced, a decision was made to not service this bypass. This bypass can be mitigated by blocking csc.exe but that may not be realistic in your environment considering the frequency in which legitimate code makes use of these methods - e.g. msbuild.exe and many PowerShell modules that call Add-Type.
Click to expand...

Exploitation
I wrote a function called Add-TypeRaceCondition that will accept attacker-supplied C# and get an allowed call to Add-Type to compile it and load it within the constraints of constrained language mode. The weaponized bypass is roughly broken down as follows:

Spawn a child process of PowerShell that constantly tries to drop the malicious .cs file to %TEMP%.

Maximize the process priority of the child PowerShell process to increase the likelihood of winning the race.

In the parent PowerShell process, import a Microsoft-signed PowerShell module that calls Add-Type – I chose the PSDiagnostics process for this.

Kill the child PowerShell process.

At this point, you will have likely won the race and your type will be loaded in place of the legitimate one expected by PSDiagnostics.

In reality, the payload wins the race a little more than 50% of the time. If Add-TypeRaceCondition doesn’t work on the first try, it will almost always work on the second try.
Do note that while I weaponized this bypass for PowerShell, this can be weaponized using anything that would allow you to overwrite the dropped .cs file quickly enough. I've weaponized the bypass using a batch script, VBScript, and with WMI. I'll leave it up to the reader to implement a bypass using their language of choice.
Click to expand...

Detection
Unfortunately, detection using free, off-the-shelf tools will be difficult due to the fact that the disk artifacts are created and subsequently deleted and by the nature of System.Reflection.Assembly.Load(byte[]) not generating a traditional module load event that something like Sysmon would be able to detect.
Vendors with the ability to hash files on the spot should consider assessing the prevalence of DLLs created by csc.exe. Files with low prevalence should be treated as suspicious. Also, unfortunately, since dynamically created DLLs by their nature will not be signed, there will be no code signing heuristics to key off of.
Click to expand...

Conclusion

I remain optimistic of Device Guard’s ability to enforce user mode code integrity. It is a difficult problem to tackle, however, and there is plenty of attack surface. In most cases, Device Guard UMCI bypasses can be mitigated by a user in the form of CI blacklist rules. Unfortunately, in my opinion, no realistic user mitigation of this particular bypass is possible. Microsoft not servicing such a bypass is the exception and not the norm. Please don’t let this discourage you from reporting any bypasses that you may find to secure@microsoft.com. It is my hope that by releasing this bypass that it will eventually be addressed and it will provide other vendors with the opportunity to mitigate.
Click to expand...

ExtremeGamerBR · Jul 10, 2017

Thanks @WildByDesign , interesting read.

csc.exe is blocked of execution here (thanks Bouncer).

This bypass can be mitigated by blocking csc.exe
Click to expand...

Log in or Sign up

Bypassing Device Guard with .NET Assembly Compilation Methods

WildByDesign Registered Member

ExtremeGamerBR Registered Member

Log in or Sign up

Bypassing Device Guard with .NET Assembly Compilation Methods

WildByDesign Registered Member

ExtremeGamerBR Registered Member

Useful Searches